--- title: "Fix Access Denied: Take Ownership with takeown and icacls" description: "Fix access denied on a locked Windows folder with takeown and icacls. Make Administrators the owner, grant Full Control, and clear any deny entries." canonical: "https://adamtheautomator.com/takeown-icacls-take-ownership-folder/" --- # Fix Access Denied: Take Ownership with takeown and icacls > Fix access denied on a locked Windows folder with takeown and icacls. Make Administrators the owner, grant Full Control, and clear any deny entries. Source: https://adamtheautomator.com/takeown-icacls-take-ownership-folder/ --- ATA Learning Tap to hide [ ATA Learning ](/) * [Home](/) * [Tutorials](/tutorials/) * [Instructors](/author/) * [Advertising](/advertising/) * [Recommended Resources](/resources/) * [About Adam](/about-adam/) Search for: * [](https://twitter.com/adbertram) * [](https://github.com/Adam-the-Automator) * [](https://www.linkedin.com/company/adam-the-automator-llc) * [](/feed/) ![Fix Access Denied: Take Ownership with takeown and icacls](https://adamtheautomator.com/wp-content/uploads/publisher/3f95d9c85b2b8185a49bd1349023dba2/6163dc370e63610afdd7af994bd2a13ae5a715944748901293297069e411bff0.jpg) # Fix Access Denied: Take Ownership with takeown and icacls [![](https://secure.gravatar.com/avatar/d0b9d42e21e5622713f8b693aa5c0f9244d5f7dd200ed29b8398f52dee5de337?s=192&d=mm&r=g)Adam Bertram](https://adamtheautomator.com/author/adam-bertram/)19 October 20263 min. read Categories: [IT Ops](/category/it-ops/) Tags:[Windows](/tag/windows/)[File Management](/tag/file-management/)[Security](/tag/security/) Table of Contents * [Prerequisites](#prerequisites) * [Take Ownership with takeown](#take-ownership-with-takeown) * [Run takeown on the Folder](#run-takeown-on-the-folder) * [Grant Full Control with icacls](#grant-full-control-with-icacls) * [Run icacls on the Folder](#run-icacls-on-the-folder) * [Confirm the New Owner and Permissions](#confirm-the-new-owner-and-permissions) * [Clear a Deny Entry That Still Blocks You](#clear-a-deny-entry-that-still-blocks-you) * [Hand Ownership to a Different Account](#hand-ownership-to-a-different-account) _Access denied_ (n.): what Windows tells an administrator who opens a folder that belongs to a deleted account, an old Windows install, or another user. Behind that definition sits the folder’s owner, the account Windows lets rewrite who may open the folder even when the owner can’t open it. ## Prerequisites To follow along, you need: * Windows 10, Windows 11, or Windows Server 2016 or later * An account in the local Administrators group * A Command Prompt opened with [**Run as administrator**](https://learn.microsoft.com/en-us/windows/security/application-security/application-control/user-account-control/how-it-works) ## Take Ownership with takeown Fixing the lockout takes two commands: `takeown` makes the Administrators group the owner, then [`icacls`](https://adamtheautomator.com/icacls/) grants that group Full Control. Before you change anything, run [`dir /q D:\`](https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/dir) and write down what the owner column shows for the `LockedFolder` row. File Explorer shows the dialog below when your account lacks permission to open the folder. ![Access denied dialog](https://adamtheautomator.com/wp-content/uploads/publisher/c6c2f90e94be44d6e833d2e18db188e1d74a5b8c158015fd2ae46529e1616039.jpg) ### Run takeown on the Folder The [takeown command](https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/takeown) moves ownership in one pass: ```text takeown /F "D:\LockedFolder" /A /R /D Y ``` * `/F` names the folder. * `/A` gives ownership to the Administrators group instead of your own account. * `/R` repeats the change for every file and subfolder. * `/D Y` answers yes whenever takeown meets a folder you can’t list. * * * _**Warning: The takeown reference says that with /D Y “The directory permissions are replaced with permission granting the user full control only.” The page never says how /A changes that. Point it at your own data folders and never at C:\\Windows.**_ * * * ## Grant Full Control with icacls The discretionary access control list (DACL) is the list of who may do what to a folder. The [Get-Acl page on Microsoft Learn](https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.security/get-acl) explains why the owner comes first: “The DACL list is controlled by the resource owner.” As the new owner, the Administrators group can add its own entry to the DACL. ### Run icacls on the Folder ```text icacls "D:\LockedFolder" /grant "*S-1-5-32-544:(OI)(CI)F" /T /C /Q ``` The [well-known security identifier (SID)](https://learn.microsoft.com/en-us/windows/win32/secauthz/well-known-sids) `S-1-5-32-544` identifies the local Administrators group. The rest of the argument breaks down like this: | Piece | What it does | | --- | --- | | `F` | Full access | | `(OI)(CI)` | Files and subfolders inherit the entry | | `/T` | Applies the entry to everything already inside | | `/C` | Continues past files that return errors | | `/Q` | Suppresses success messages | * * * _**Pro Tip: The command above names the group by its numeric SID (icacls reads a SID when you put \* in front of it), which stays the same on installs where the Administrators group has a translated name.**_ * * * ## Confirm the New Owner and Permissions Two listings tell you whether both commands landed; the first prints the DACL. The second uses the [dir command’s /q switch](https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/dir) to display ownership. ```text icacls "D:\LockedFolder" dir /q D:\ ``` You want these two lines, as the screenshot below shows: * `BUILTIN\Administrators:(OI)(CI)(F)` in the icacls listing * `BUILTIN\Administrators` in the owner column of the `LockedFolder` row in the dir listing ![Owner and DACL check](https://adamtheautomator.com/wp-content/uploads/publisher/bb9eedd0c997bdb8599b1b324560ae23eb2da6486ae0c8de4362383f729fbde7.jpg) Open the folder once both lines match. With User Account Control on, File Explorer runs without your administrator rights and shows the **Continue** prompt again. Clicking **Continue** grants your own account Full Control of the folder and everything in it, as [Microsoft’s article on the Continue prompt](https://learn.microsoft.com/en-us/troubleshoot/windows-server/windows-security/dont-have-permission-access-folder) explains. Still locked out? Look for a `(DENY)` line in the same listing. ## Clear a Deny Entry That Still Blocks You icacls keeps entries in [canonical order](https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/icacls#remarks), explicit denials ahead of explicit grants. Any explicit `(DENY)` line for the Administrators group, or for a group you belong to, outranks the explicit Full Control entry you just granted. ```text icacls "D:\LockedFolder" /remove:d "*S-1-5-32-544" /T /C /Q ``` The `/remove:d` switch removes every denied right for the SID you name. Swap in the account shown on the `(DENY)` line if it isn’t the Administrators group, then rerun the listing to confirm the line is gone. ## Hand Ownership to a Different Account To hand the folder to someone else, for example a user whose files you’re restoring, use `icacls` with the owner as an argument (`takeown` can only name you or the Administrators group): ```text icacls "D:\LockedFolder" /setowner "CONTOSO\jsmith" /T /C ``` The [`/setowner` switch](https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/icacls) changes the owner of all matching files to the specified user. Adding `/T` carries that to the contents. The new owner still needs access. So rerun the `/grant` command with `CONTOSO\jsmith:(OI)(CI)F` in place of `*S-1-5-32-544:(OI)(CI)F`. Then check the owner column once more. Share this article [Share on X](https://twitter.com/intent/tweet?url=https%3A%2F%2Fadamtheautomator.com%2Ftakeown-icacls-take-ownership-folder%2F&text=Fix%20Access%20Denied%3A%20Take%20Ownership%20with%20takeown%20and%20icacls)[Share on Facebook](https://www.facebook.com/sharer/sharer.php?u=https%3A%2F%2Fadamtheautomator.com%2Ftakeown-icacls-take-ownership-folder%2F)[Share on LinkedIn](https://www.linkedin.com/sharing/share-offsite/?url=https%3A%2F%2Fadamtheautomator.com%2Ftakeown-icacls-take-ownership-folder%2F) ## Related Posts ![](https://adamtheautomator.com/wp-content/uploads/2022/11/How-to-Install-NitroShare-for-Cross-Platform-File-Transfer.jpg) ### [Install NitroShare and Streamline Your File Transfers Today](/nitroshare/) Simplify cross-platform file transfers with NitroShare. This tutorial guides you through installation and use for fast, effortless file sharing between different operating systems. ![](https://adamtheautomator.com/wp-content/uploads/2022/11/How-to-Set-Up-Storage-Spaces-Direct-Step-by-Step.jpg) ### [How to Set Up Storage Spaces Direct \[Step-by-Step\]](/storage-spaces-direct/) Learn how to take advantage of and utilize the Windows capability of storage spaces direct in this in-depth guide via ATA Learning! ![](https://adamtheautomator.com/wp-content/uploads/publisher/3f95d9c85b2b817aab5dca59f1ca0e14/38378bffb6e067df12a1bd90a3921833213a6e328f7d3baabd1fae698d38ddfd.jpg) ### [Fix Kerberos Clock Skew Logon Failures Using w32tm](/fix-kerberos-clock-skew-w32tm/) Fix Kerberos clock skew logon failures by checking w32tm sources, pointing the PDC emulator at NTP, and resyncing drifted clients. ## Categories * [IT Ops](/category/it-ops/) * [Cloud](/category/cloud/) * [DevOps](/category/devops/) * [Home Ops](/category/home-ops/) * [Information Security](/category/infosec/) * [Software Development](/category/software-development/) ## Site * [Home](/) * [Tutorials](/tutorials/) * [Instructors](/author/) * [Advertising](/advertising/) * [Recommended Resources](/resources/) * [About Adam](/about-adam/) Copyright 2026© ATA Learning | [Privacy Policy](/privacy/)